Outline of Interim Report from Study Group on Countermeasures against Spam

International Affairs Department, Telecommunications Bureau Vol. 18 No. 18 Biweekly Newsletter of the Ministry of Internal Affairs and Communications (MIC), Japan ISSN 1349-7987 Please feel free to use the articles in this publication, with proper credits. STUDY GROUP REPORT Outline of Interim Report from Study Group on Countermeasures against Spam Background and current state of countermeasures against spam With regard to countermeasures against spam, the passing of the Law on Regulation of Transmission of Specified Electronic Mail (hereinafter referred to as "the Law") in 2002 was followed in 2005 by a revision that further tightened it. This, along with efforts by telecommunications carriers and ISPs, has been having some effect, but the volume of spam continues to rise, and the way of spam sending is getting more serious. Other issues have also appeared such as regulatory effectiveness and the increase in the volume of spam originating overseas. The state of affairs in other countries Globally, the percentage of spam has accounted for around 70 to 80% of all electronic mails. Countries other than Japan are steadily strengthening their measures against spam, for example, regulations that use the opt-in method (An approach to prohibit email sending when a sender has not been previously obtain consent from a recipient) are becoming the mainstream of their anti-spam laws. Overview of discussion on countermeasures against spam With regard to countermeasures against spam, it is necessary to pursue an integrated policy as per the illustration below, as well as adopt a multi-disciplinary approach in which any possible method should be swiftly implemented. It is necessary to discuss on the antispam legal system in this interim report since the legal system is important for providing us with a basic framework to promote the integrated anti-spam policy. STUDY GROUP REPORT Outline of Interim Report from Study Group on Countermeasures against Spam TOPICS Developing Communications Terminals for the IP Era International Policy Division, International Affairs Department, Telecommunications Bureau, Ministry of Internal Affairs and Communications (MIC) 1-2, Kasumigaseki 2-chome, Chiy odaku, Tokyo 100-8926, Japan Fax: +81-3-5253-5924 Tel: +81-3-5253-5920 We welcome your comments via: http://www.soumu.go.jp/joho_tsusin/ eng/contact.html 1 7 MIC Communications News is available at: http://www.soumu.go.jp/joho_tsusin/ eng/newsletter.html Presentation materials of MIC are available at: http://www.soumu.go.jp/joho_tsusin/ eng/presentation.html E-mail distribution of this newsletter is possible if desired. 1

(5) International coordination (3) Technical solution Sender Spam Sending side ISP Spam Receiving side ISP Spam Recipient (2) Self-regulation by telecommunications carriers and ISPs (4) Enhancing awareness of users (1) Implementation of effective legal system by government When taking into consideration the current state of countermeasures against spam and the progress in countermeasures against spam in various countries, it is necessary to review the current legislation in some ways since the legislation is difficult to implement. With regard to review on the legislation, there should, in concrete terms, be review on the Law from the three perspectives outlined below. (1) Tightening countermeasures against spam getting more serious (2) Strengthening the legal effectiveness (3) Strengthening international conformity and coordination A framework for review on the legislation (1) Tightening countermeasures against spam getting more serious (a) Scope and problems of the current legislation With regard to the emails that are currently causing a problem, a considerable proportion is included in the scope of the current regulations but the recent use of botnets and transmission of phishing messages, etc. shows a move towards greater viciousness and demands the further discussion on countermeasures against spam. (b) An approach to regulations for spam that is sent using botnets There has been an increase in spam sent out by "botnet" networks that are made up of virus infected PCs that can be operated from the outside without notice to the PC users. Some of this type of transmission pattern had not been envisaged in the Law and it is therefore necessary to investigate regulation methods that would include a framework for application of the Law to this type of spam sending. Spammer (1) Distribution of virus using email transmission or browser vulnerability (3) Instructions to the virus infected PCs (In some cases instructions are not necessary. The person who instructs PCs can be different from the person who distributes the virus.) Spam recipients (4) Large-scale transmission of spam from the virus infected PCs (In many cases each transmission source only sends out a small volume) Ordinary home-use PC (2) The PC becomes a "zombie" through virus infection The PC user remains unaware Botnet 2

(c) An approach to regulations to handle phishing emails, etc. The application of the current legislation seems to be difficult with regard to the transmission of phishing emails, but from the point of view of a notable loss in (Example of phishing email) Entering of ID number, account number, or password on log-in page confidence in the use of emails for sales activities and interference in the smooth operation of emails, phishing emails can be seen as a suitable target of the Law, and it would be appropriate to investigate this further. In addition, there Forged web site resembling that of a socially credible institution should also be an investigation by the government as whether the application of the Law is needed to emails with "one-click fraudulent" invitation. Personal information, credit information ID: Password: Account number: Access Email recipient Email including the link to the forged website Due to a revision in our systems, it has become necessary to ask our customers using online accounts to re-register. Please click the link below to go to the registration page... Phisher (2) Review on the current opt-out method (a) The significance of the current legislation and the state of affairs following its enforcement With regard to the current opt-out method for regulating advertising and promotional emails, there have been some changes in the status of the rule implementation. Opt-in oriented e-mail advertisement is becoming the mainstream of the legal sales activities, while the labeling duty as a part of the optout regulation is not observed by most spammers. There are also indications that the core mechanism of the opt-out method, which requires recipients to notify senders to stop email sending is acting as an invitation of more spam sending to recipients. These factors show that the current optout regulation is not functioning smoothly. Therefore, it might be appropriate to introduce an opt-in approach when recipient's refusal can be assumed. (b) The necessity of increasing international conformity At the time when the Law was enacted in 2002, it was a pioneering anti-spam law in the world, but since that time, there have been advances in spam countermeasure legislations in various countries. With regard to regulations on the sending of advertising and promotional emails, most major countries have adopted opt-in approaches. The increase in emails coming from overseas requires urgent action through the strengthening of international coordination, and it seems necessary that this should be based on improving international systemic conformity. From that point of view, it might be appropriate to introduce an opt-in approach in Japan. 3

EU United Kingdom United States Australia The Netherlands France Germany Korea China Japan July 2002 Introduction of opt-in (Directive 2002/58/EC) December 2003 Opt-in introduced based on the directive January 2004 (Regulation implemented from August) Introduction of opt-in for mobile phones April 2004 Introduction of opt-in May 2004 Opt-in introduced based on the directive June 2004 Opt-in introduced based on the directive July 2004 Opt-in introduced based on the directive March 2005 Opt-in introduced for telephones March 2006 Introduction of opt-in July 2002 November 2005 Introduction of opt-out Revision of legislation No change to opt-out (c) Issues related to business activities The review on the existing opt-out method should pursue to balance in fulfilling the aim of the regulation; it is necessary to take into consideration the current state of email usage of business activities, and to avoid a system that would place a heavy burden on those who send emails as part of legal business activities. (3) Strengthening the legal effectiveness In order to have in place more efficient countermeasures against spam in the future, it is necessary to increase the legal effectiveness. Four types of systems should be considered to contribute to the legal effectiveness as follows: (a) A system that would increase both the costs and risks involved for senders of spam (b) A system that would decrease the costs and risks involved for recipients of spam (c) A system that would make it easier for those providing email services to take autonomous countermeasures (d) A system that would make it easier for law enforcement agencies to take measures for the enforcement 4

(Example of strengthening the legal effectiveness) Sender Recipient Anti-spam consulting center MIC Making it possible to request information based on the Law Relevant entities such as telecommunications carriers, domain name registrants Making it possible to provide information on their subscribers Reporting order, administrative order, etc. (4) Strengthening international conformity and coordination With the rapid increase of spam sent from overseas, it is necessary to strengthen international coordination. In order to do this, it is necessary to investigate whether regulations should be applicable to the spam originated in foreign countries as well as put in place a system to exchange sender information with foreign governments. It is necessary to review the legal system so as to make it possible to handle these points. In addition, coordination in the private sector is important in this approach, and it is necessary to promote action in this area. Furthermore, it is desirable that Japan's legal system is brought into line so as to increase its international conformity. (Directions in future international coordination) Overseas ministries and government offices Exchange of information on government antispam policy MIC Actions Exchange of spam sender information (to be implemented starting with countries that have Actions completed preparations) - Discussions and exchange of information on spam countermeasures - Promotion of international coordination Sender Sending spam to Japan from overseas Sender International framework (OECD, LAP, etc.) Sending spam overseas from Japan Recipient Recipient 5

(5) Evaluation of the legal system for spam With regard to the review on the legal system, there should be an evaluation concerning the anticipated effects, and the public announcement of these results should work towards improving the quality of the legal system. It is also important to obtain the broad understanding of the people and is therefore necessary to know clearly what kind of effect have been obtained by revisions of the legal system. Topics for continuous discussions in the Study Group It will be necessary to continue discussions on topics and issues for a future framework, such as further promoting the introduction by telecommunications carriers and ISPs of measures based on their terms and conditions, and the introduction of technical solutions such as OP25B or sender domain name authentication. Other issues will include raising users' awareness to encourage the use of filtering services, and greater international coordination at the government level and private sector level. In addition, it is necessary to continue discussions as for a desired rule about obtaining recipient's consent when sending advertisement or promotional emails. In order to combine various measures in a multi-faceted and organic way in the area of countermeasures against spam, it is necessary for this study group to continue its discussions so as to control and prevent the flow of spam. 6

TOPICS Developing Communications Terminals for the IP Era Background to the diversification of communications terminals A wide variety of communications terminals are appearing in Japan and communications devices are becoming ever more present. In the background to this development are the rapid spread and expansion of broadband environments that use high-speed access technologies such as DSL (Digital Subscriber Line), FTTH (Fiber to the Home), and cable Internet access as well as the impact of increased use of IP (Internet Protocol) services with advanced networks. Activities to create next-generation IP networks are increasing in intensity. The shift to IP for constructing networks will make it possible to provide services that allow communications terminals that in the past could be connected only at the end of existing telephone networks to operate in collaboration with networks. In response to the changing roles that communications terminals must play as a result of the use of IP-based networks, it is necessary to develop system and technological environments by 2010 when next-generation IP networks will be put into full-scale operation. Consequently, the Ministry of Internal Affairs and Communications held meetings of the Study Group on Communications Terminals in the IP Era (chaired by AIDA Hitoshi, professor, Graduate School of Frontier Sciences, University of Tokyo) from December 2006 through August 2007 to investigate the development of the environments necessary for the creation of communications terminals in the IP era. The study group investigated the following topics: (1) The image of communications terminals in light of developments concerning the adoption of IP; (2) Necessary elements for communications terminals compatible with developments relating to the adoption of IP; and (3) Issues concerning the use of information terminals compatible with future IP developments and the future course of action. Image of future communications terminals in the IP era Next-generation IP networks are expected to begin full-scale operation in 2010. The study group investigated how network technologies and services that use them will advance in 2010 and 2015 taking into consideration the progress of the shift to IP networks and the possibility that the majority of networks will be IP networks by 2015, leading to the development of IP-based social infrastructure. Networks in 2010 Changes such as the integration of communications and broadcasting and the appearance of Web 2.0 are already anticipated, and as nextgeneration IP networks go into operation in about 2010, full-scale services will appear and the expansion of IP networks that use high-speed data communications such as WiMAX and WiFi will accelerate. In addition, communications carriers will adopt IP for both fixed and mobile networks and a shift will be made to all IP networks. Also, communications networks will be linked by IP networks for the provision of even more advanced services. Networks in 2015 Against a backdrop of a further advance in mobile networks including practical application of 4G as the successor to 3G, services that integrate mobile and fixed networks will appear and a truly ubiquitous access era with a diverse range of services such as FMC that uses common platforms will begin to develop. In conjunction with the diversification of services and communications terminals such as human communications for short-range communications that use the human body in place of cables and communications with contactless IC cards, networks will need communications interfaces and capabilities suitable for these types of communications as networks diversify. Advances in terminal technologies As mobile phones have diversified over the past several years, many communications terminals have adopted multiple functions and general-purpose terminals that act as service platforms have appeared. Until now, terminals have been connected at the ends of networks and their capabilities depended on network capabilities, but in the future there will be a shift from this type of networkdependent service model to a multi-service application model that relies on collaboration between networks and terminals. Advances in applications, content, and other environments As a result of the adoption of open networks and standardization such as UNI, multi-access and multinetworks will continue to progress. In addition, future communications 7

terminals will be able to automatically select the optimal network based on information such as the content being accessed and current location of the user. Also, as different functions are incorporated into communications terminals to provide access to various networks, it will become possible to provide services without any awareness of differences in networks. At the same time, the integrated certification platforms necessary for the provision of various applications, content, and network services will allow users to freely combine various services and use terminals without constraints. Elements necessary for communications terminals in the IP era In the society that will be created by the communications terminals of the future, communications will be conducted at appropriate quality levels on infrastructure that has been integrated using IP technologies without reliance on the data format such as voice, video, or text. The society established by the various services made possible by such communications will be a safe and prosperous society with ubiquitous network access. The elements that communications terminals in the IP era will require to achieve such a society are as follows: (a) Improving connectivity for the development of an environment that allows for interconnections among diverse terminals and networks; (b) Enhancing convenience that allow users to easily access services that are increasing in complexity in conjunction with more advanced functions; and (c) Ensuring security and safety that can respond to sophisticated attack methods and respond promptly in the event of system failures. The image of advances in communications terminals in the IP era is shown in Figure 1, with the three elements described above on the vertical access and time on the horizontal axis. 8

Figure 1. Image of progress of communications terminals in the IP era Improving connectivity Seamless connections Communications quality controls Seamless connections to multiple carriers Carrier free Vender free Ability to use multiple communications protocols form a single terminal Multi-access Wireless LANs FMC Variable communications quality depending on the content and communications protocol Static communications quality control Variable communications protocols depending on the content and communications quality Multi-access Creation of personal networks Determination by the terminal of the necessary and sufficient communications protocol depending on the terminal, application, and environment Automatic selection of optimal communications lines Automatic switching of communications quality Dynamic communications quality controls Automatic creation of optical connection environments Spatial terminals Users connect to nearby terminals to create personal area networks and body area networks Links to home networks Communications functions Compact and light-weight High-resolution displays Services that integrate and use the context of the user's space with unique user information and network information Enhancing convenience Ensuring security and safety Improved user interfaces Downloadable content ID portability Prevention of attacks from terminals Prevention of attacks on terminals Settings that can be adjusted using Automatic settings and zero configuration natural language and conversation Universal designs Simple settings Automatic optimization of Intuitive, integrated interfaces interfaces for individual users Use of functions through software downloads according to the terminal and content Portable content and services Content distribution services according to the user, terminal, and environment Communications quality control Thin clients ASP functions Portable ID terminals Certification functions Payment functions Rapid recovery from failures Notification of failures through inter-terminal collaboration Prevention of attacks using terminal and user certification High security, personal certification, prevention of ID theft Defensive level setting functions for networks with different trust levels Solutions to the problem through collaboration with external networks VPN Encryption Automatic collection, updating, and use of new functions according to user needs Collection and analysis of user preferences Proposal and automatic selection of optical services Concierge services Responses to increasingly sophisticated and complex attacks Terminals and networks automatically detect, recover from, and prevent attacks and harm Responses to increasingly sophisticated and complex attacks Terminals and networks automatically detect, recover from, and prevent attacks and harm 2010 2015 9

Social and economic effects of communications terminals in the IP era The early appearance and expansion of communications terminals that can operate in conjunction with various networks will require new entry into related fields as well as invigoration of associated markets. The study group investigated the economic effects of future IP terminals, taking into consideration the incorporation of communications terminals in various devices and the appearance of completely new types of communications terminals in addition to those currently in existence. The economic effects associated with IP terminals that can connect seamlessly with various networks and operate in conjunction with those networks to provide a wide variety of services are expected to grow from the current 30.9 trillion yen to 49.9 trillion yen in 2010 and to expand further to 68.5 trillion yen in 2015 (Figure 2). If, however, connectivity and convenience cannot be ensured, the scale of the market calculated at 68.5 trillion will grow to no more than approximately 49.1 trillion yen. When the calculation is performed taking into consideration the degree of security and reliability provided, if security and reliability are inadequate, the market will be approximately 52.6 trillion yen. Figure 2. Results of calculations of the projected scale of IP terminal related markets (In trillion yen) 80 70 60 C B 68.5 7.7 C: Markets that will develop as completely new types of terminals appear 50 A 49.9 13.5 B: Markets that will develop as communications terminals are incorporated into various devices 40 8.6 30 20 30.9 30.9 41.3 47.3 A: Existing types of terminals and related markets (including broadcasting and communications) 10 0 Base market (current) 2010 2015 * Calculations by Dentsu Communication Institute Inc. 10

Creating communications terminals for the IP era Efficiently and effectively creating IP terminals is thought to be an important issue regarding the advancement of telecommunications in the future. We investigated the policies that will be necessary for the creation of IP terminals from the perspectives of advancing the positive aspects such as the creation of new services and markets and controlling the negative aspects including the problems that are expected to occur frequently from the integrated use of highly diverse terminals in various combinations. Creation of new services and markets (a) Promoting research and development and standardization In the IP era, devices that previously did not have communications functions will be equipped with communications terminals and the number of communications in devices connected to networks will increase greatly, and it is expected that the relationship between communications terminals and network services will diversify. In an IP era when communications terminals will be used in a wide range of different formats, the creation of new markets and the formation of a prosperous IP-based society will require the development of core platforms and the fundamental security technologies as well as a standardization. (b) Development of test bed structures It is expected that a series of processes starting with the use of test beds and actual operation and progressing to practical feedback to development and standardization will be established to promote standardization, achieve a proper balance between terminals and networks, and achieve both convenience and infrastructure functions in environments where diverse terminal devices are integrated such as home networks. The development of test beds will serve as large-scale research bases for preventing communications failures resulting from hardware incompatibilities and ensuring interconnectivity among the communications terminals connected to IP networks. Test beds will also be effective in eliminating factors that can hinder the growth of markets such as security risks. (c) Adoption and development of interface and function certification methods It is expected that IP terminals will be able to connect flexibly and effortlessly with numerous different networks. In addition, safely using various services that access the networks of multiple carriers will require the structures necessary for IP terminals to use the different networks, and measures to develop the environments necessary for diverse applications are needed. As a result, communications terminals for the IP era must be equipped with fundamental and new functions for improving connectivity, enhancing convenience, and ensuring security and reliability. In addition, encouraging standardization as well as adopting certification systems and guidelines concerning these will be necessary to ensure that consumers can use IP terminals with a sense of security. Development of environments that can be used with a sense of security (a) Investigating optimal division of responsibilities concerning certification of functions Currently, standardization by standardization organizations and forums creates functions through the collaboration of network participants. In the future, however, as IP terminals proliferate, the increasing complexity of the relationships among terminals, networks, and services is likely to lead to instances where current structures are unable to function. In those cases where these issues can be resolved technologically but technology development and implementation will require substantial expenditures and those cases where technological resolutions are not possible, issues may be addressed through collaboration and a division of responsibilities. With respect to the optimal division of responsibilities in the IP era, investigating models of divisions of responsibility looking ahead to 2010 when nextgeneration IP networks will go into full-scale operation will be effective, is necessary to establish forums where persons who will be involved in the design of those systems of responsibilities can participate and that will ensure transparency. (b) Investigating the best methods of protecting consumers A society in which IP terminals have become common will provide numerous benefits including prosperous lifestyles and efficient business activities, but it is also expected that many problems will arise. Such use of IP terminals will require the resolution of various issues concerning current telecommunications services and addressing various issues and problems that are expected to occur in the future. There was discussion within the study group concerning the need for measures to protect consumers such as the provision of devices that respond to diverse needs regarding the protection of consumers, simple and rapid certification of functions and remedies for violations of rights, and the establishment of agencies 11

and the systems for the protection of consumers. Further investigation of these issues in the future is warranted. (c) Use of qualification systems adapted to the IP era Currently, qualification of the engineers who perform construction work for connecting terminal facilities with networks is the responsibility of the party who performs the construction. In the IP era, however, it is expected that the role of terminals will be to perform various functions in collaboration with networks, and therefore the role of engineers in relation to connectivity and other matters will change. Looking ahead to the IP era, it will be necessary to reflect IP content in qualification tests and to review concepts regarding engineer education. Also, maintenance service providers, makers, and users are all involved in IP terminals, and consequently educational activities to raise the level of awareness of these parties such as the use of original qualifications granted by industry organizations to certify technology levels will be necessary. Creating dynamic information terminals The study group conducted repeated investigations of the image of communications terminals in light of trends concerning the increasing adoption of IP based systems in response to changes in the roles that communications terminals will be required to play as a result of the increased use of IPbased networks. The group also examined the functions necessary for achieving such terminals, the social and economic effects, and issues regarding use of information terminals adapted to the future advances in IP networks. Changes in the construction of networks arising from the adoption of IP will transform the role of communications terminals, which until now have been connected only at the ends of networks, into collaboration with networks, resulting in such terminals playing a role in the creation of the areas of functions and services. Achieving this, however, will require addressing comprehensively a wide range of issues. The implementation of immediate and effective measures to address these issues is also necessary from the perspective of Japan's social and economic growth and maintaining international competitiveness. The IP era will transform terminals. The study group recommends strongly that industry, academia, and government collaborate to take immediate and effective measures addressing this transformation from a global perspective. Appendix: An image of IP terminal usage in 201X I participated in a new product development conference using a taxi seat display. It appeared that the traffic congestion was not going to let up and I wanted to use a larger screen, so I exited the taxi and moved to a nearby cafe. I switched communications to my mobile terminal so I could continue the discussion while going to the cafe. By simply holding an ID card over the mobile terminal, all of the communications content up to that point was instantly transferred to the mobile terminal. At the same time, a mark was displayed in the taxi seat display indicating that all usage history had been deleted. Thus, even if an employee from a competitor rode in the same taxi, there were no concerns that the employee would be able to access product images or a record of the discussion. At the cafe, a cutting-edge display that can project threedimensional images before one's eyes was on the table. I again held up the ID card and the scene of the conference that had been communicated on my compact mobile terminal was instantly transferred to the large screen. From the table, a high-quality communications line suitable for three-dimensional image communications was automatically connected. I was able to make convincing explanations to the other participants in the conference while displaying the results of a market survey that I had conducted and graphs of competition for market share with rival makers. Thanks to these advantages, I received approval for development of the new product. ' ' ' 12

Figure 3. An image of IP terminal usage in 201X Seamless connection We're having a hard time coming to a decision. Will you be here soon? I'll switch to my personal terminal. Content portability using a certificate function In the cafe ' e Confidentiality is protected. First, please look at the market survey data I prepared concerning this products. I'm stuck in traffic, so I'm going to get out and find a cafe. ' The optimal communications line is selected automatically and the communications quality dynamically controlled. While walking What is your opinion concerning this proposal...? 13